osv-scanner.toml

# OSV-Scanner suppression policy — single source of truth.
#
# All vulnerability suppressions live in this file (decisions DD-01 / Q1 / Q2 / Q9 in
# .copilot-tracking/research/2026-05-23/osv-scanner-and-lerobot-torch-research.md).
# Do NOT add `--ignore` flags to npm scripts, setup-dev scripts, or CI workflows;
# every workflow and CLI invocation reads this file via `--config osv-scanner.toml`.
#
# Each [[IgnoredVulns]] entry MUST include both `reason` and `ignoreUntil`.
# Each [[PackageOverrides]] entry MUST include both `reason` and `effectiveUntil`.
# `ignoreUntil` and `effectiveUntil` are TOML local-date literals (unquoted, YYYY-MM-DD).
#
# Template:
#
# [[IgnoredVulns]]
# id = "GHSA-xxxx-xxxx-xxxx"
# ignoreUntil = 2026-12-31
# reason = "Upstream fix pending in <package> v<X.Y.Z>; tracked in <issue-link>."

# === Package overrides ===
#
# Use [[PackageOverrides]] for findings tied to a specific package+version that
# are not reachable at runtime (e.g., transitives of test fixtures).

# idna 3.9.0 — transitive of pinned `requests` / `flask` entries in
# scripts/tests/Fixtures/Pip/ and shared/ci/tests/Fixtures/Pip/. Those files are
# static test data for Test-DependencyPinning.ps1 and are never installed at
# runtime. Finding: GHSA-65pc-fj4g-8rjx (fixed in idna 3.15).
[[PackageOverrides]]
name = "idna"
version = "3.9.0"
ecosystem = "PyPI"
vulnerability.ignore = true
effectiveUntil = 2026-12-31
reason = "Static test-fixture transitive; never installed. Re-evaluate by 2026-12-31 or refresh fixtures."